@xfey/tutti 0.1.122 → 0.1.124

package/dist/server-shell/local-console/browser-bridge.d.ts

@@ -0,0 +1,10 @@
+import type { FastifyInstance } from "fastify";
+import { type LocalConsoleSessionRegistry } from "./session.js";
+/** No caller-controlled destinations, control routes, session cookies or header forwarding. */
+export declare function isConsoleBridgeOperation(method: string, path: string): boolean;
+export declare function registerConsoleBrowserBridge(app: FastifyInstance, options: {
+    sessions: LocalConsoleSessionRegistry;
+    now?: () => Date;
+    tuttiHome?: string;
+}): void;
+//# sourceMappingURL=browser-bridge.d.ts.map

package/dist/server-shell/local-console/browser-bridge.js

@@ -0,0 +1,286 @@
+import { createHash, randomBytes } from "node:crypto";
+import { resolveRelayUrl } from "../cli/launch.js";
+import { serializeRuntimeLogLine } from "@tutti/shared/utils";
+import { appendHostLogLine, getHostLogFilePath } from "../cli/machine-local.js";
+import { LOCAL_CONSOLE_SESSION_COOKIE } from "./session.js";
+const BASE = "/local-console/bridge/v1";
+const IDLE_MS = 15 * 60_000;
+const LIFETIME_MS = 12 * 60 * 60_000;
+const secret = () => randomBytes(32).toString("base64url");
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const tokenPattern = /^[A-Za-z0-9_-]{43}$/u;
+/** No caller-controlled destinations, control routes, session cookies or header forwarding. */
+export function isConsoleBridgeOperation(method, path) {
+    if (method === "GET") {
+        return ([
+            "/bootstrap",
+            "/projects",
+            "/heartbeat",
+            "/package-update",
+            "/package-update?refresh=true",
+        ].includes(path) || /^\/projects\/prj_[A-Za-z0-9]{1,64}\/feishu-setup$/u.test(path));
+    }
+    return (method === "POST" &&
+        ([
+            "/folders/pick",
+            "/providers/models",
+            "/projects/launch",
+            "/package-update",
+            "/account/managed-usage",
+        ].includes(path) ||
+            /^\/projects\/prj_[A-Za-z0-9]{1,64}\/(?:open|invite|stop)$/u.test(path) ||
+            /^\/managed-projects\/(?:prepare|authorize|read|reconcile|validate|launch)$/u.test(path)));
+}
+function validOrigin(origin) {
+    if (typeof origin !== "string")
+        return false;
+    try {
+        const url = new URL(origin);
+        return (url.origin === origin &&
+            !url.username &&
+            !url.password &&
+            (url.protocol === "https:" || (url.protocol === "http:" && url.hostname === "127.0.0.1")));
+    }
+    catch {
+        return false;
+    }
+}
+function objectWithKeys(value, required, optional = []) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        required.every((key) => Object.hasOwn(value, key)) &&
+        Object.keys(value).every((key) => required.includes(key) || optional.includes(key)));
+}
+export function registerConsoleBrowserBridge(app, options) {
+    const registry = new Map();
+    app.addHook("onResponse", (request, reply, done) => {
+        if (options.tuttiHome && request.url.startsWith(`${BASE}/`)) {
+            const suffix = request.url.slice(BASE.length);
+            const stage = [
+                "/session",
+                "/account",
+                "/account/complete",
+                "/request",
+                "/disconnect",
+            ].includes(suffix)
+                ? suffix.slice(1).replaceAll("/", "_")
+                : "rejected";
+            try {
+                appendHostLogLine(getHostLogFilePath(options.tuttiHome), serializeRuntimeLogLine({
+                    service: "host",
+                    component: "console-bridge",
+                    level: reply.statusCode >= 400 ? "warn" : "info",
+                    message: "Console bridge request",
+                    now: options.now ?? (() => new Date()),
+                    fields: { request_id: request.id, stage, status: reply.statusCode },
+                }));
+            }
+            catch {
+                /* Diagnostic failure never changes access or reveals request data. */
+            }
+        }
+        done();
+    });
+    const now = () => (options.now?.() ?? new Date()).getTime();
+    const remove = (key, entry) => {
+        options.sessions.revokeSession(entry.session);
+        if (entry.continuation)
+            options.sessions.revokeAccessToken(entry.continuation);
+        registry.delete(key);
+    };
+    const purge = () => {
+        for (const [key, entry] of registry) {
+            if (entry.expires <= now() || entry.touched + IDLE_MS <= now())
+                remove(key, entry);
+        }
+    };
+    const fail = (request, reply, status, code) => reply.code(status).send({
+        error: {
+            code,
+            message: "Reconnect this computer from Projects.",
+            retryable: false,
+            request_id: request.id,
+        },
+    });
+    // A preflight is only a transport negotiation. Every actual request separately authenticates
+    // its native-configured origin and entry capability; a successful OPTIONS grants no access.
+    app.addHook("onRequest", (request, reply, done) => {
+        if (!request.url.startsWith(`${BASE}/`))
+            return done();
+        reply.header("cache-control", "no-store").header("vary", "Origin");
+        if (!validOrigin(request.headers.origin)) {
+            void fail(request, reply, 403, "bridge_origin_rejected");
+            return;
+        }
+        if (request.url.includes("?")) {
+            void fail(request, reply, 400, "bridge_input_invalid");
+            return;
+        }
+        reply
+            .header("access-control-allow-origin", request.headers.origin)
+            .header("access-control-expose-headers", "x-tutti-request-id");
+        if (request.method === "OPTIONS") {
+            const requested = String(request.headers["access-control-request-headers"] ?? "")
+                .toLowerCase()
+                .split(",")
+                .map((v) => v.trim())
+                .filter(Boolean);
+            if (request.headers["access-control-request-method"] !== "POST" ||
+                requested.some((v) => !["authorization", "content-type"].includes(v))) {
+                void fail(request, reply, 403, "bridge_preflight_rejected");
+                return;
+            }
+            reply
+                .header("access-control-allow-methods", "POST")
+                .header("access-control-allow-headers", "authorization, content-type")
+                .header("access-control-allow-private-network", "true");
+            void reply.code(204).send();
+            return;
+        }
+        done();
+    });
+    app.options(`${BASE}/*`, (_request, reply) => reply.code(204).send());
+    app.post(`${BASE}/session`, (request, reply) => {
+        purge();
+        const body = request.body;
+        if (!objectWithKeys(body, ["access_token"]) ||
+            typeof body.access_token !== "string" ||
+            !tokenPattern.test(body.access_token))
+            return fail(request, reply, 400, "bridge_input_invalid");
+        const context = options.sessions.readEntryContext(body.access_token);
+        const origin = request.headers.origin;
+        const configured = context ? resolveRelayUrl(context.environment).replace(/\/$/u, "") : null;
+        if (!context || !validOrigin(origin) || configured !== origin)
+            return fail(request, reply, 403, "bridge_entry_rejected");
+        if (registry.size >= 16)
+            return fail(request, reply, 429, "bridge_capacity_reached");
+        const session = options.sessions.exchangeAccessToken(body.access_token, undefined, undefined, true);
+        if (!session?.sessionToken)
+            return fail(request, reply, 401, "bridge_entry_expired");
+        const token = secret();
+        registry.set(hash(token), {
+            origin,
+            session: session.sessionToken,
+            context: session.contextToken,
+            csrf: session.csrfToken,
+            touched: now(),
+            expires: now() + LIFETIME_MS,
+        });
+        return { bridge_token: token };
+    });
+    function authenticate(request) {
+        purge();
+        const bearer = /^Bearer ([A-Za-z0-9_-]{43})$/u.exec(String(request.headers.authorization ?? ""))?.[1];
+        const key = bearer ? hash(bearer) : "";
+        const entry = registry.get(key);
+        if (!entry ||
+            entry.origin !== request.headers.origin ||
+            !options.sessions.readSession(entry.session, entry.context))
+            return null;
+        entry.touched = now();
+        return [key, entry];
+    }
+    app.post(`${BASE}/disconnect`, (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        if (request.body !== undefined)
+            return fail(request, reply, 400, "bridge_input_invalid");
+        remove(...auth);
+        return { status: "disconnected" };
+    });
+    app.post(`${BASE}/account`, (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        if (request.body !== undefined)
+            return fail(request, reply, 400, "bridge_input_invalid");
+        const entry = auth[1];
+        const session = options.sessions.readSession(entry.session, entry.context);
+        if (session.accountReady)
+            return fail(request, reply, 409, "bridge_account_already_ready");
+        if (entry.continuation)
+            options.sessions.revokeAccessToken(entry.continuation);
+        const issued = options.sessions.issueAccountContinuation(session.context);
+        entry.continuation = issued.token;
+        return { access_token: issued.token, expires_at: issued.expires_at };
+    });
+    app.post(`${BASE}/account/complete`, (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        const entry = auth[1];
+        const body = request.body;
+        if (!objectWithKeys(body, ["access_token", "account_display_name"]) ||
+            body.access_token !== entry.continuation ||
+            typeof body.access_token !== "string" ||
+            typeof body.account_display_name !== "string" ||
+            !body.account_display_name.trim() ||
+            body.account_display_name.length > 80)
+            return fail(request, reply, 400, "bridge_account_mismatch");
+        const session = options.sessions.exchangeAccessToken(body.access_token, undefined, body.account_display_name, true);
+        if (!session?.sessionToken)
+            return fail(request, reply, 401, "bridge_account_expired");
+        options.sessions.revokeSession(entry.session);
+        entry.session = session.sessionToken;
+        entry.context = session.contextToken;
+        entry.csrf = session.csrfToken;
+        delete entry.continuation;
+        return { status: "ready" };
+    });
+    app.post(`${BASE}/request`, async (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        const [key, entry] = auth;
+        const body = request.body;
+        if (!objectWithKeys(body, ["method", "path"], ["body"]) ||
+            typeof body.method !== "string" ||
+            typeof body.path !== "string" ||
+            !isConsoleBridgeOperation(body.method, body.path) ||
+            (body.body !== undefined && typeof body.body !== "string") ||
+            (body.method === "GET" && body.body !== undefined))
+            return fail(request, reply, 400, "bridge_operation_rejected");
+        if (!options.sessions.readSession(entry.session, entry.context)?.accountReady)
+            return fail(request, reply, 401, "bridge_account_required");
+        const response = await app.inject({
+            method: body.method,
+            url: `/local-console/v1${body.path}`,
+            headers: {
+                host: request.headers.host,
+                origin: `http://${request.headers.host}`,
+                cookie: `${LOCAL_CONSOLE_SESSION_COOKIE}=${entry.session}`,
+                "x-local-console-context": entry.context,
+                "x-local-console-csrf": entry.csrf,
+                ...(body.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            ...(body.body === undefined ? {} : { payload: body.body }),
+        });
+        purge();
+        if (registry.get(key) !== entry)
+            return fail(request, reply, 401, "bridge_session_required");
+        if (response.rawPayload.length > 2 * 1024 * 1024)
+            return fail(request, reply, 502, "bridge_response_too_large");
+        let data;
+        try {
+            data = response.json();
+        }
+        catch {
+            return fail(request, reply, 502, "bridge_response_invalid");
+        }
+        // The reused controller only needs a readiness marker; never expose native cookie/CSRF.
+        if (body.path === "/bootstrap" &&
+            typeof data === "object" &&
+            data !== null &&
+            "csrf_token" in data)
+            data = { ...data, csrf_token: "bridge" };
+        return reply.code(response.statusCode).send(data);
+    });
+    app.addHook("onClose", (_instance, done) => {
+        for (const [key, entry] of registry)
+            remove(key, entry);
+        done();
+    });
+}
+//# sourceMappingURL=browser-bridge.js.map

package/dist/server-shell/local-console/managed-project-routes.js

@@ -14,6 +14,7 @@ const ReadSchema = Type.Object({ request_ref: IdempotencyKeySchema }, { addition
 const ConfirmSchema = Type.Object({ request_ref: IdempotencyKeySchema, trial_consent: Type.Literal(PROJECT_TRIAL_POLICY) }, { additionalProperties: false });
 export function registerLocalConsoleManagedProjectRoutes(app, options) {
     for (const operation of [
+        "usage",
         "prepare",
         "authorize",
         "read",
@@ -21,7 +22,9 @@ export function registerLocalConsoleManagedProjectRoutes(app, options) {
         "validate",
         "launch",
     ]) {
-        app.post(`/local-console/v1/managed-projects/${operation}`, {
+        app.post(operation === "usage"
+            ? "/local-console/v1/account/managed-usage"
+            : `/local-console/v1/managed-projects/${operation}`, {
             bodyLimit: 8192,
             errorHandler: (error, request, reply) => {
                 if (error.code !== "FST_ERR_CTP_INVALID_JSON_BODY" &&
@@ -69,7 +72,16 @@ export function registerLocalConsoleManagedProjectRoutes(app, options) {
                 if (Object.keys(request.query).length)
                     throw new ManagedLocalStateError("managed_creation_input_invalid");
                 let result;
-                if (operation === "prepare") {
+                if (operation === "usage") {
+                    if (!Value.Check(Type.Object({}, { additionalProperties: false }), request.body))
+                        throw new ManagedLocalStateError("managed_creation_input_invalid");
+                    result = await options.service.readAccountUsage(session.context, session.accountHandoff?.token);
+                    const current = options.requireSession(request, true);
+                    if (!current.accountReady ||
+                        current.accountHandoff?.token !== session.accountHandoff?.token)
+                        throw new ManagedLocalStateError("console_setup_access_invalid");
+                }
+                else if (operation === "prepare") {
                     if (!Value.Check(ManagedDraftInputSchema, request.body))
                         throw new ManagedLocalStateError("managed_creation_input_invalid");
                     result = await options.service.prepare(request.body, session.context);

package/dist/server-shell/local-console/managed-project-service.d.ts

@@ -75,6 +75,16 @@ export declare class LocalConsoleManagedProjectService {
             trial_consent: "trial-project-v1";
         };
     };
+    readAccountUsage(context: LocalConsoleInvocationContext, consoleToken?: string): Promise<{
+        state: "not_initialized";
+        unit: "newapi_quota";
+    } | {
+        state: "ready";
+        unit: "newapi_quota";
+        remaining: number;
+        used: number;
+        request_count: number;
+    }>;
     authorize(requestRef: string, context: LocalConsoleInvocationContext, consoleToken?: string): Promise<{
         draft: {
             state: "validation_failed" | "prepared" | "registered" | "validated" | "awaiting_authorization" | "validation_unknown";

package/dist/server-shell/local-console/managed-project-service.js

@@ -1,5 +1,5 @@
 import { Value } from "@sinclair/typebox/value";
-import { prepareNativeConsoleAuthority } from "@tutti/relay-client";
+import { prepareNativeConsoleAuthority, readNativeConsoleAccountUsage } from "@tutti/relay-client";
 import { Type } from "@sinclair/typebox";
 import { IdempotencyKeySchema, ProjectIdSchema } from "@tutti/shared/schemas/domain";
 import { resolveLaunchLocalContext } from "../cli/launch.js";
@@ -109,6 +109,16 @@ export class LocalConsoleManagedProjectService {
             preparation: state.preparationBody(requestRef),
         };
     }
+    readAccountUsage(context, consoleToken) {
+        if (!consoleToken)
+            throw new ManagedLocalStateError("console_setup_access_invalid");
+        // Reading credit creates no project, journal, gateway account or credential.
+        return readNativeConsoleAccountUsage({
+            relayUrl: this.environment(context).TUTTI_RELAY_URL ?? "https://tutti.now",
+            consoleToken,
+            ...(this.options.fetchImpl === undefined ? {} : { fetchImpl: this.options.fetchImpl }),
+        });
+    }
     async authorize(requestRef, context, consoleToken) {
         return this.options.operations.runProjectOperation(async () => {
             if (!consoleToken)

package/dist/server-shell/local-console/project-service.d.ts

@@ -18,6 +18,7 @@ export type LocalConsoleProject = {
     provider_status: ProviderConfigProjection["status"];
     provider_model?: string;
     relay_project_ref?: RelayProjectRef;
+    relay_origin?: string;
     open_url?: string;
     relay_connection_status?: string;
     created_at?: string;

package/dist/server-shell/local-console/project-service.js

@@ -91,6 +91,7 @@ function validateProjectMetadata(input) {
 }
 function projectFromRuntimeRow(row, providerStatus, providerModel, metadata) {
     const currentVersion = readCliVersion();
+    const relayOrigin = safeRelayOrigin(metadata.relayUrl);
     const openUrl = metadata.surfaceProfile.kind === "standalone"
         ? projectOpenUrl(metadata.relayUrl, row.relay_project_ref)
         : undefined;
@@ -103,6 +104,7 @@ function projectFromRuntimeRow(row, providerStatus, providerModel, metadata) {
         provider_status: providerStatus,
         ...(providerModel === undefined ? {} : { provider_model: providerModel }),
         ...(row.relay_project_ref === undefined ? {} : { relay_project_ref: row.relay_project_ref }),
+        ...(relayOrigin === undefined ? {} : { relay_origin: relayOrigin }),
         ...(openUrl === undefined ? {} : { open_url: openUrl }),
         ...(row.relay_connection_status === undefined
             ? {}
@@ -115,6 +117,17 @@ function projectFromRuntimeRow(row, providerStatus, providerModel, metadata) {
             : { update_required: true }),
     };
 }
+function safeRelayOrigin(value) {
+    try {
+        const url = new URL(value ?? "");
+        return !url.username && !url.password && (url.protocol === "https:" || url.protocol === "http:")
+            ? url.origin
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function projectOpenUrl(relayUrl, relayProjectRef) {
     if (relayUrl === undefined || relayProjectRef === undefined) {
         return undefined;

package/dist/server-shell/local-console/server.js

@@ -1,4 +1,5 @@
 import { timingSafeEqual } from "node:crypto";
+import { registerConsoleBrowserBridge } from "./browser-bridge.js";
 import { LocalConsoleManagedProjectService } from "./managed-project-service.js";
 import { registerLocalConsoleManagedProjectRoutes } from "./managed-project-routes.js";
 import { existsSync, statSync } from "node:fs";
@@ -193,6 +194,11 @@ export function createLocalConsoleServer(options) {
             ...(options.now === undefined ? {} : { now: options.now }),
         }),
     });
+    registerConsoleBrowserBridge(app, {
+        sessions,
+        tuttiHome,
+        ...(options.now === undefined ? {} : { now: options.now }),
+    });
     app.get(`${LOCAL_CONSOLE_API_BASE}/health`, () => ({
         status: "ready",
         protocol_version: 2,

package/dist/server-shell/local-console/session.d.ts

@@ -27,7 +27,11 @@ export declare class LocalConsoleSessionRegistry {
     });
     issueAccessToken(context: LocalConsoleInvocationContext): IssuedLocalConsoleAccessToken;
     issueAccountContinuation(context: LocalConsoleInvocationContext): IssuedLocalConsoleAccessToken;
-    exchangeAccessToken(token: string, existingSessionToken?: string, accountDisplayName?: string): ExchangedLocalConsoleSession | null;
+    exchangeAccessToken(token: string, existingSessionToken?: string, accountDisplayName?: string, isolated?: boolean): ExchangedLocalConsoleSession | null;
+    /** Inspect only a fresh native entry, never an account-ready continuation. */
+    readEntryContext(token: string): LocalConsoleInvocationContext | null;
+    revokeAccessToken(token: string): void;
+    revokeSession(token: string): void;
     readSession(token: string | undefined, contextToken?: string): ReadLocalConsoleSession | null;
 }
 export declare function parseCookieHeader(header: string | undefined): Record<string, string>;

package/dist/server-shell/local-console/session.js

@@ -55,7 +55,7 @@ export class LocalConsoleSessionRegistry {
         });
         return { token, expires_at: new Date(expiresAt).toISOString() };
     }
-    exchangeAccessToken(token, existingSessionToken, accountDisplayName) {
+    exchangeAccessToken(token, existingSessionToken, accountDisplayName, isolated = false) {
         this.#purgeExpired();
         const accessTokenHash = hashSecret(token);
         const accessToken = this.#accessTokens.get(accessTokenHash);
@@ -68,7 +68,7 @@ export class LocalConsoleSessionRegistry {
         let sessionToken;
         let sessionHash = "";
         let session;
-        if (existingSessionToken !== undefined) {
+        if (!isolated && existingSessionToken !== undefined) {
             sessionHash = hashSecret(existingSessionToken);
             const existingSession = this.#sessions.get(sessionHash);
             if (existingSession !== undefined &&
@@ -77,7 +77,7 @@ export class LocalConsoleSessionRegistry {
                 session = existingSession;
             }
         }
-        if (session === undefined && this.#browserSessionToken !== undefined) {
+        if (!isolated && session === undefined && this.#browserSessionToken !== undefined) {
             const sharedSessionHash = hashSecret(this.#browserSessionToken);
             const sharedSession = this.#sessions.get(sharedSessionHash);
             if (sharedSession !== undefined &&
@@ -90,7 +90,8 @@ export class LocalConsoleSessionRegistry {
         }
         if (session === undefined) {
             sessionToken = createSecret();
-            this.#browserSessionToken = sessionToken;
+            if (!isolated)
+                this.#browserSessionToken = sessionToken;
             sessionHash = hashSecret(sessionToken);
             session = {
                 hash: sessionHash,
@@ -129,6 +130,21 @@ export class LocalConsoleSessionRegistry {
             expires_at: new Date(session.expiresAt).toISOString(),
         };
     }
+    /** Inspect only a fresh native entry, never an account-ready continuation. */
+    readEntryContext(token) {
+        this.#purgeExpired();
+        const access = this.#accessTokens.get(hashSecret(token));
+        return access && !access.accountReady && secretEquals(token, access.hash)
+            ? access.context
+            : null;
+    }
+    revokeAccessToken(token) {
+        this.#accessTokens.delete(hashSecret(token));
+    }
+    revokeSession(token) {
+        this.#sessions.delete(hashSecret(token));
+        this.#purgeExpired();
+    }
     readSession(token, contextToken) {
         this.#purgeExpired();
         if (token === undefined || token.trim() === "") {

package/node_modules/@tutti/relay-client/dist/project-authority.d.ts

@@ -21,6 +21,18 @@ export declare function prepareNativeConsoleAuthority(options: Transport & {
     surface: "standalone" | "feishu";
     creation_ref: string;
 }>;
+export declare function readNativeConsoleAccountUsage(options: Transport & {
+    consoleToken: string;
+}): Promise<{
+    state: "not_initialized";
+    unit: "newapi_quota";
+} | {
+    state: "ready";
+    remaining: number;
+    unit: "newapi_quota";
+    used: number;
+    request_count: number;
+}>;
 export declare function validateNativeCreationAuthority(options: Transport & {
     body: NativeCreationProof;
 }): Promise<{

package/node_modules/@tutti/relay-client/dist/project-authority.js

@@ -1,4 +1,6 @@
 import { Value } from "@sinclair/typebox/value";
+import { Type } from "@sinclair/typebox";
+import { ManagedAccountUsageSchema } from "@tutti/shared/schemas/api";
 import { HostDelegationProjectionSchema, HostDelegationStatusBodySchema, NativeCreationProofSchema, NativeCreationStatusSchema, CreationValidationResultSchema, NativeRuntimeAuthorizationSchema, ConsoleProjectAuthoritySchema, ManagedCreationProjectionSchema, } from "@tutti/shared/schemas/internal";
 export class NativeAuthorityTransportError extends Error {
     code;
@@ -14,6 +16,7 @@ export class NativeAuthorityTransportError extends Error {
 }
 const safeReasons = new Set([
     "console_setup_access_invalid",
+    "managed_usage_unavailable",
     "project_already_registered",
     "project_authority_conflict",
     "command_replay_mismatch",
@@ -114,6 +117,15 @@ export async function prepareNativeConsoleAuthority(options) {
         throw new NativeAuthorityTransportError("managed_authority_invalid_response");
     return result;
 }
+const ConsoleUsageSchema = Type.Pick(ConsoleProjectAuthoritySchema, ["console_token"], {
+    additionalProperties: false,
+});
+export async function readNativeConsoleAccountUsage(options) {
+    const body = { console_token: options.consoleToken };
+    if (!Value.Check(ConsoleUsageSchema, body))
+        throw new NativeAuthorityTransportError("managed_authority_invalid_request");
+    return request(options, "/host-control/v1/managed-authority/account-usage", body, ManagedAccountUsageSchema);
+}
 export async function validateNativeCreationAuthority(options) {
     if (!Value.Check(NativeCreationProofSchema, options.body))
         throw new NativeAuthorityTransportError("managed_authority_invalid_request");

package/node_modules/@tutti/shared/dist/schemas/api/account-projects.d.ts

@@ -0,0 +1,14 @@
+import { type Static } from "@sinclair/typebox";
+export declare const AccountProjectsSchema: import("@sinclair/typebox").TObject<{
+    projects: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        relay_project_ref: import("@sinclair/typebox").TString;
+        display_name: import("@sinclair/typebox").TString;
+        surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+        role: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+        host_status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"online">, import("@sinclair/typebox").TLiteral<"offline">, import("@sinclair/typebox").TLiteral<"unknown">]>;
+        last_opened_at: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>>;
+    truncated: import("@sinclair/typebox").TBoolean;
+}>;
+export type AccountProjects = Static<typeof AccountProjectsSchema>;
+//# sourceMappingURL=account-projects.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/api/account-projects.js

@@ -0,0 +1,19 @@
+import { Type } from "@sinclair/typebox";
+import { IsoDateTimeStringSchema, RelayProjectRefSchema } from "../domain/index.js";
+// Account navigation metadata only. Feishu rows never confer workspace authority.
+export const AccountProjectsSchema = Type.Object({
+    projects: Type.Array(Type.Object({
+        relay_project_ref: RelayProjectRefSchema,
+        display_name: Type.String(),
+        surface: Type.Union([Type.Literal("standalone"), Type.Literal("feishu")]),
+        role: Type.Union([Type.Literal("owner"), Type.Literal("member")]),
+        host_status: Type.Union([
+            Type.Literal("online"),
+            Type.Literal("offline"),
+            Type.Literal("unknown"),
+        ]),
+        last_opened_at: Type.Optional(IsoDateTimeStringSchema),
+    }, { additionalProperties: false }), { maxItems: 100 }),
+    truncated: Type.Boolean(),
+}, { additionalProperties: false });
+//# sourceMappingURL=account-projects.js.map

package/node_modules/@tutti/shared/dist/schemas/api/index.d.ts

@@ -26,4 +26,5 @@ export { ContextSyncBodySchema, ContextSyncDispositionSchema, ContextSyncPayload
 export * from "./feishu-documents.js";
 export * from "./external-references.js";
 export * from "./feishu-connections.js";
+export * from "./account-projects.js";
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/api/index.js

@@ -22,4 +22,5 @@ export { ContextSyncBodySchema, ContextSyncDispositionSchema, ContextSyncPayload
 export * from "./feishu-documents.js";
 export * from "./external-references.js";
 export * from "./feishu-connections.js";
+export * from "./account-projects.js";
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.122",
+  "version": "0.1.124",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",